acrstealer | ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae.bin.dll
Size 3.5MB
Sample260919-sprf8asdph
SHA256 ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae
MD5 fcbc8cdae4a0c5cc0bd5e95b21987a51
SHA1 253f5e4ca4df454ed4d04fde7a3277a6b189a860
SHA512 e0ec0ce54651b2cfd56ce427d27903e51ab28786433c3eda865ab6ab22470519d3d5b5b35e44ed117451758c064c4452c9a6f7b87e1699dded18ce38c5efa604
SSDEEP 49152:H9WJUK/poxbEIscEOwWDgudxkwkDx2t8dKvUsZw7ilXsZWcalJHm0HPa4HrG9ewb:W
TLSH
T10506D6662D52782BD3FD32BC148B2F17B8BD7D6365F41CAA419409A478D2C79C2CBD0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution acrstealer persistence spyware stealer

Malware Config

Extracted

Family

acrstealer

Version

4.3.1-alpha1

health.winnererasable.cc

Decoy

cloudflare.com

Attributes

ddrs
https://telegra.ph/Built-in-Types-08-01
guids
019fd851-d0e2-7805-ae09-2dd1daa78960

f1575b64-8492-4e8b-b102-4d26e8c70371
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer

Detects ACRStealer V4.x 57 IoCs

resource	yara_rule
behavioral1/memory/5096-1-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-5-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-9-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-41-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-47-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-46-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-88-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-105-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-146-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-183-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-200-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-239-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-245-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-395-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-396-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-397-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-404-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-408-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-410-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-435-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-878-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-879-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-882-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-883-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-885-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-889-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-893-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-891-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-896-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-898-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-904-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-910-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-916-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-922-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-926-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-928-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-934-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-933-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-936-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-938-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-935-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-932-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-942-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-940-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-944-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-948-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-950-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-951-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-957-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-999-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-1357-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-1358-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-2565-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-2567-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-2600-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-2601-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3
behavioral1/memory/5096-2605-0x00000000022F0000-0x00000000023AC000-memory.dmp	family_acrstealer_v3

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 5096 created 3280	5096	rundll32.exe	56
PID 5096 created 3280	5096	rundll32.exe	56
PID 5096 created 3280	5096	rundll32.exe	56

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
14	5096	rundll32.exe
15	5096	rundll32.exe
16	5096	rundll32.exe
17	5096	rundll32.exe
18	5096	rundll32.exe
19	5096	rundll32.exe
139	5096	rundll32.exe
140	5096	rundll32.exe
148	5096	rundll32.exe
149	5096	rundll32.exe
150	5096	rundll32.exe
169	5096	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5096	rundll32.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3324	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3932	msedge.exe
1728	chrome.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5096	rundll32.exe
5096	rundll32.exe
5096	rundll32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5828	chrome.exe
Token: SeCreatePagefilePrivilege	5828	chrome.exe
Token: SeShutdownPrivilege	5828	chrome.exe
Token: SeCreatePagefilePrivilege	5828	chrome.exe
Token: SeShutdownPrivilege	5828	chrome.exe
Token: SeCreatePagefilePrivilege	5828	chrome.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3324	powershell.exe
Token: SeSecurityPrivilege	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	3324	powershell.exe
Token: SeLoadDriverPrivilege	3324	powershell.exe
Token: SeSystemProfilePrivilege	3324	powershell.exe
Token: SeSystemtimePrivilege	3324	powershell.exe
Token: SeProfSingleProcessPrivilege	3324	powershell.exe
Token: SeIncBasePriorityPrivilege	3324	powershell.exe
Token: SeCreatePagefilePrivilege	3324	powershell.exe
Token: SeBackupPrivilege	3324	powershell.exe
Token: SeRestorePrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeSystemEnvironmentPrivilege	3324	powershell.exe
Token: SeRemoteShutdownPrivilege	3324	powershell.exe
Token: SeUndockPrivilege	3324	powershell.exe
Token: SeManageVolumePrivilege	3324	powershell.exe
Token: 33	3324	powershell.exe
Token: 34	3324	powershell.exe
Token: 35	3324	powershell.exe
Token: 36	3324	powershell.exe
Token: SeIncreaseQuotaPrivilege	3324	powershell.exe
Token: SeSecurityPrivilege	3324	powershell.exe
Token: SeTakeOwnershipPrivilege	3324	powershell.exe
Token: SeLoadDriverPrivilege	3324	powershell.exe
Token: SeSystemProfilePrivilege	3324	powershell.exe
Token: SeSystemtimePrivilege	3324	powershell.exe
Token: SeProfSingleProcessPrivilege	3324	powershell.exe
Token: SeIncBasePriorityPrivilege	3324	powershell.exe
Token: SeCreatePagefilePrivilege	3324	powershell.exe
Token: SeBackupPrivilege	3324	powershell.exe
Token: SeRestorePrivilege	3324	powershell.exe
Token: SeShutdownPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeSystemEnvironmentPrivilege	3324	powershell.exe
Token: SeRemoteShutdownPrivilege	3324	powershell.exe
Token: SeUndockPrivilege	3324	powershell.exe
Token: SeManageVolumePrivilege	3324	powershell.exe
Token: 33	3324	powershell.exe
Token: 34	3324	powershell.exe
Token: 35	3324	powershell.exe
Token: 36	3324	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
5828	chrome.exe
3604	msedge.exe
3368	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5912 wrote to memory of 5096	5912	rundll32.exe	85
PID 5096 wrote to memory of 5828	5096	rundll32.exe	89
PID 5828 wrote to memory of 3004	5828	chrome.exe	90
PID 5828 wrote to memory of 3820	5828	chrome.exe	91
PID 5828 wrote to memory of 3820	5828	chrome.exe	91
PID 5828 wrote to memory of 1728	5828	chrome.exe	92
PID 5828 wrote to memory of 1916	5828	chrome.exe	93
PID 5828 wrote to memory of 1916	5828	chrome.exe	93
PID 5828 wrote to memory of 1368	5828	chrome.exe	95
PID 5828 wrote to memory of 5244	5828	chrome.exe	96
PID 5828 wrote to memory of 1368	5828	chrome.exe	95
PID 5828 wrote to memory of 5244	5828	chrome.exe	96
PID 5828 wrote to memory of 4080	5828	chrome.exe	97
PID 5828 wrote to memory of 4080	5828	chrome.exe	97
PID 5828 wrote to memory of 4476	5828	chrome.exe	98
PID 5828 wrote to memory of 4476	5828	chrome.exe	98
PID 5096 wrote to memory of 3604	5096	rundll32.exe	99
PID 3604 wrote to memory of 5824	3604	msedge.exe	100
PID 3604 wrote to memory of 3932	3604	msedge.exe	101
PID 3604 wrote to memory of 4228	3604	msedge.exe	102
PID 3604 wrote to memory of 4228	3604	msedge.exe	102
PID 3604 wrote to memory of 4228	3604	msedge.exe	102
PID 3604 wrote to memory of 5696	3604	msedge.exe	103
PID 3604 wrote to memory of 5696	3604	msedge.exe	103
PID 3604 wrote to memory of 3948	3604	msedge.exe	104
PID 3604 wrote to memory of 3948	3604	msedge.exe	104
PID 3604 wrote to memory of 3948	3604	msedge.exe	104
PID 3604 wrote to memory of 1484	3604	msedge.exe	105
PID 3604 wrote to memory of 1484	3604	msedge.exe	105
PID 3604 wrote to memory of 1484	3604	msedge.exe	105
PID 1220 wrote to memory of 3368	1220	firefox.exe	109
PID 1220 wrote to memory of 3368	1220	firefox.exe	109
PID 3368 wrote to memory of 4580	3368	firefox.exe	110
PID 3368 wrote to memory of 4580	3368	firefox.exe	110
PID 3368 wrote to memory of 4580	3368	firefox.exe	110
PID 3368 wrote to memory of 4580	3368	firefox.exe	110
PID 3368 wrote to memory of 5388	3368	firefox.exe	111
PID 3368 wrote to memory of 5388	3368	firefox.exe	111
PID 3368 wrote to memory of 5388	3368	firefox.exe	111
PID 3368 wrote to memory of 5388	3368	firefox.exe	111
PID 3368 wrote to memory of 5240	3368	firefox.exe	112
PID 3368 wrote to memory of 5240	3368	firefox.exe	112
PID 3368 wrote to memory of 5240	3368	firefox.exe	112
PID 3368 wrote to memory of 4284	3368	firefox.exe	113
PID 3368 wrote to memory of 4284	3368	firefox.exe	113
PID 3368 wrote to memory of 4284	3368	firefox.exe	113
PID 3368 wrote to memory of 4284	3368	firefox.exe	113
PID 3368 wrote to memory of 5716	3368	firefox.exe	116
PID 3368 wrote to memory of 5716	3368	firefox.exe	116
PID 3368 wrote to memory of 5716	3368	firefox.exe	116
PID 3368 wrote to memory of 5716	3368	firefox.exe	116
PID 3368 wrote to memory of 3436	3368	firefox.exe	117
PID 3368 wrote to memory of 3436	3368	firefox.exe	117
PID 3368 wrote to memory of 3436	3368	firefox.exe	117
PID 3368 wrote to memory of 3436	3368	firefox.exe	117
PID 3368 wrote to memory of 5444	3368	firefox.exe	118
PID 3368 wrote to memory of 5444	3368	firefox.exe	118
PID 3368 wrote to memory of 5444	3368	firefox.exe	118
PID 3368 wrote to memory of 5444	3368	firefox.exe	118
PID 3368 wrote to memory of 5436	3368	firefox.exe	119
PID 3368 wrote to memory of 5436	3368	firefox.exe	119
PID 3368 wrote to memory of 5436	3368	firefox.exe	119
PID 3368 wrote to memory of 5436	3368	firefox.exe	119
PID 5096 wrote to memory of 3324	5096	rundll32.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae.bin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ec360687d55a94fb637dec26ffcaa58171b1501437db02d0485f86e1812016ae.bin.dll,#1
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Badlisted process makes network request
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3324
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\SysWOW64\dllhost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe1549c728,0x7ffe1549c734,0x7ffe1549c740
    3⤵
    PID:3004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,11156789127414450777,596622250648466207,262144 --field-trial-handle=1816,i,17407870746918438190,12588809117763175279,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    PID:3820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1588,i,12839702536754242280,3866756644132909515,524288 --field-trial-handle=1816,i,17407870746918438190,12588809117763175279,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2688 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,1291250084010652960,15489276626065526932,524288 --field-trial-handle=1816,i,17407870746918438190,12588809117763175279,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2708 /prefetch:8
    3⤵
    PID:1916
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,12959445688358763645,16153991814221402461,2097152 --field-trial-handle=1816,i,17407870746918438190,12588809117763175279,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:1368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,18126801330355940751,4885987593565884180,2097152 --field-trial-handle=1816,i,17407870746918438190,12588809117763175279,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:5244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4128,i,214900350775074816,9929357100531919454,2097152 --field-trial-handle=1816,i,17407870746918438190,12588809117763175279,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4236 /prefetch:2
    3⤵
    PID:4080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,8278202015729441345,10606038999194301728,2097152 --field-trial-handle=1816,i,17407870746918438190,12588809117763175279,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --no-default-browser-check
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffe0196c188,0x7ffe0196c194,0x7ffe0196c1a0
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8785411367035354576,4783787769309754890,524288 --field-trial-handle=2320,i,895819264677835492,3383123007406520251,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8461440618380204016,6978236423799150578,262144 --field-trial-handle=2320,i,895819264677835492,3383123007406520251,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,11158958569105253621,17663545219539703783,524288 --field-trial-handle=2320,i,895819264677835492,3383123007406520251,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
    3⤵
    PID:5696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,322235920891931843,8569619129827218473,2097152 --field-trial-handle=2320,i,895819264677835492,3383123007406520251,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,2869532827328063366,5336901891216838634,2097152 --field-trial-handle=2320,i,895819264677835492,3383123007406520251,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:1484
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -headless
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2404 -prefsLen 27099 -prefMapHandle 2408 -prefMapSize 270315 -ipcHandle 2472 -initialChannelId {a7dba85e-3239-443b-b021-df4e289d540a} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket
      4⤵
      PID:4580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3412 -prefsLen 27240 -prefMapHandle 3416 -prefMapSize 270315 -jsInitHandle 3420 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3428 -initialChannelId {a8bf63dc-78c5-4664-9e54-14e4d1dc51b4} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 tab
      4⤵
      Checks processor information in registry
      PID:5388
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3596 -prefsLen 27240 -prefMapHandle 3600 -prefMapSize 270315 -ipcHandle 3680 -initialChannelId {917c2f32-ce68-434d-80e8-a84e9b37c274} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 rdd
      4⤵
      PID:5240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2784 -prefsLen 34788 -prefMapHandle 4288 -prefMapSize 270315 -jsInitHandle 4312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4320 -initialChannelId {d676786d-bdea-44a4-97a5-72016822f5ca} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 tab
      4⤵
      Checks processor information in registry
      PID:4284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5008 -prefsLen 34976 -prefMapHandle 5012 -prefMapSize 270315 -ipcHandle 4616 -initialChannelId {7fab8d88-12cd-4aa7-9b6d-5d178e95a24b} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 utility
      4⤵
      Checks processor information in registry
      PID:5716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5132 -prefsLen 32864 -prefMapHandle 5136 -prefMapSize 270315 -jsInitHandle 5140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5148 -initialChannelId {fdcedd8a-7a6b-4c6d-8127-2fad1c4ad55f} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
      4⤵
      Checks processor information in registry
      PID:3436
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5172 -prefsLen 32864 -prefMapHandle 5188 -prefMapSize 270315 -jsInitHandle 5192 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {7ca5de5f-58aa-447c-9f74-0d73e3e8b543} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
      4⤵
      Checks processor information in registry
      PID:5444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5604 -prefsLen 32864 -prefMapHandle 5608 -prefMapSize 270315 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {e08a532c-fbb9-4b1f-8128-43a42e6cf86f} -parentPid 3368 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3368" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
      4⤵
      Checks processor information in registry
      PID:5436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 08e741f7b270156ddee8c9d1e37f9441b6f3a3e99cab5d7aa6b1ca7d3d2001a1
MD5 e7aa7b1813b6a8aefb4d2bde9f11c0ff
SHA1 c0b637157055ff168ffec1c153ca3538e5ece169
SHA512 58da082e40fc6dc59fdf3b8120ad79b57fadf9bdc2c8b9204cc98d9f83b7b948cc08ff37b86608b3a4c54e30b0eb6aa59541e02419d5cf3610221f4ef9db5d94
SSDEEP 3072:U+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:U+hFD+7t56OD9ZfSAppry
TLSH
T189D31232AA91C8BBC9BC6541B157A304DE76ACED41DE3A09444A5F8EE09FD4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 8b36e43232843fb1ca0a21c3344b07b38856ebf257f21ab46a9d549b0c3ebb3d
MD5 17f746a1e16b815f29f47fbfe1bd0e04
SHA1 70444643c16c033c890d0cf51b379e21ca230a63
SHA512 00c05a2bc0221ca19f81599bf311a4bab64f83d9dff7e36467b2313307a50a35175b7c5808b3b4c775c9c7c4ab148ded42c222ccd602d3db07d8cbc621cff13c
SSDEEP 192:P+x3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1C524640A7B787001EDE3D9725CB080771E3CA16DCF22A6915DB654694EB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b77b36a50c84179d9edb132c34dea9e323f039ce2b77e6f1209c49442d82dcaa
MD5 3ae08ff14ef3d79936d649ba2cea8d66
SHA1 0d6986e9cb0a70f3845ddf6ea626c025c99c0cb4
SHA512 9e22d478e88a5d0fb9cb23854795f3a47be50c9f1d61a2869231d82d5681572c767d4747a90b81a3e5053d75a7aeb022d6833a77e405854c3358ffcce66a8f56
SSDEEP 384:nSiFiZcI63sNZ8TUNTUlIm25mg5tnK2flBCupuSAiOesa+VYqgL/7IzaoQ:ZFQ63owgSiJBnpf4ehgCz
TLSH
T154C25B36EC99D9BBECEA4FD9AB4A7A07DEE41167909C8AC0DAD91D1C00871DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f7162da8c01897e6fd637f76923d99712349b513d7b459cfe5ea2751efafcdea
MD5 1d3ffe42fc1ffe69d9087349727b1a3b
SHA1 5bdaf1be77e6f03cc48214d39e94c648eba0367e
SHA512 1a5a0373e935828ea91383a812162440a2331ea46a459ebb2fcd8a1ee5c52234c64a9e63f0351459ca8527ca53e7311abd9bb7a966a3e38b5a2e1ec8625e13e2
SSDEEP 384:nSiFiZcI63sN18TUNTUlIm25mgKX0K2flBCupuSAiJM4xsa+VYqgL/7IzaoQ:ZFQ63cwgSd6Bnpf4ghgCz
TLSH
T129C25C31E899CDBBECEA4FE9A74A7A43DEE41163849C8AC4DAD95D1C00C71DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ykvnrhrj.iyg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ykvnrhrj.iyg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 175be1fdee1ea51f180c5648ac2f9a15990f682f0d6b0fd7ce3569606d22288b
MD5 329ed653d409800ee3119ab980c7c396
SHA1 e852ac01248ed72b7d2048f79b80b5d069f755bc
SHA512 700dafb439e0a68f1812a3caf6f4a338994eb419b2a0735ef85694912f7df70ddecf3c832abd2e6e28866f40a47ed4faba323cbd5ff22f50c5717e129a3eb79e
SSDEEP 192:n1d66JozGzgCl6mBM2ioPOv5zbowWGv8yjvBc:1d66JozGzgC1OFogbowWGv8yjv
TLSH
T191D10FA4FA28563FC408523BCCB50F410E3A3957984E7F1A31DD64082D9B2DE7A8D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 7b7f5982d23fecb243ded603f040030b5e5ddc821bd625f2d85afda1466b211a
MD5 0d5e67159fa6b601dc54b68bec4bf74c
SHA1 a5836b87dbbf5993065e72bc13ea7e18d5621cb7
SHA512 30a7008c6e3c48e3e62c8db401db8e5319b672e4bff15406701802be40e6628ecf4f160a2004fe096011cf19e022c18c03de7bb907d248a80a5ad6fb44568f41
SSDEEP 192:61d66JozGzgCl6mBM2JoPOv5zbowsGv8yjvBc:kd66JozGzgC1OeogbowsGv8yjv
TLSH
T132E110A8FA29563FC408527BCCB50F400F3A398B984E3F19719D64182D972DD768D1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\events\events
Size 1KB
SHA256 36971bdc6ff363ecb224d0ba96a16efcbd276e72345209d4ba5daa2a5930e4f6
MD5 f9b5d04894022925e93d022dcc4e01aa
SHA1 ae9b8549d6ffb98b7aa9f49a047238087580c7a7
SHA512 32bc1abb5aac1dabd0b8972eebd5da43249b7b55a3b69915a231632c8cad6d21439d001fd7689cdb30a6b1c6f0e87b56b497567db1873825fa8341ddbabb09fb
TLSH
T1AC115B5C3EF94EA9E8CAD298749007CE57118E0A04471D934E13EF8DCE90ADD322E439
MD5 SHA1 SHA512 TLSH

Submit Download

083e4b25-b512-4e30-83b3-6f8d322a598f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\083e4b25-b512-4e30-83b3-6f8d322a598f
Size 235B
SHA256 e6970e0db47f455273ffcd649f770bd0bf13eec44891128c1b17e03691f3246d
MD5 bb44624b5edeede4b129a2ba29179d55
SHA1 233549220b8f43694fd79ca4e03a776806eec40e
SHA512 ef61e721d223b9bd9a5146e41e64bb2b2e2f03e4b17ccefb140634cf0e9af4c8cd1dfa2420b9efc9ae316ed82af0014fc106ba31d6215ef8f5b5e9744b486393
TLSH
T102D097802898A36D08100F02B0F0BAC730448C3354B09860A951AA74AEF9EC88261C5A
MD5 SHA1 SHA512 TLSH

Submit Download

363ba2b0-f4c2-4d7a-99f4-f7fae5a0fb1b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\363ba2b0-f4c2-4d7a-99f4-f7fae5a0fb1b
Size 15KB
SHA256 8c8eae309d71525d8ee6334433a797ea5bb3aa6deb3aaddfe285550862079907
MD5 0b1076ad55c05b07d2bc69484e1b8081
SHA1 4d4b9c6e38bb0f55a43ed9a64a14fe622ac669e6
SHA512 066f62666bbdff2ea7741c4fd3561cc827061236a91526e2a056734f48efa58a6e6bec2f51afcf343f36745691670cb3298c8a5f47be698a23eedc561f1fa212
SSDEEP 192:AVQG3m4UzUELD4z8kuTSDpz4DLT95gS4HoBj1T5Jb0Ygv9rSm4DjQT2+pIz:AG48zUELD4z8rTSDpkvT95J4IdS2kW
TLSH
T17972D7162820597A8651E399D4FCBFC3E6F628CF4C419FCA9BE47D085DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bc59b0c-a74b-4264-af10-012584d3908a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\5bc59b0c-a74b-4264-af10-012584d3908a
Size 235B
SHA256 180b567a386aa171208b312bfacf63764879ea00b5c1998deeb0f50a8e056a3c
MD5 e834e6c13b33631f9b6a57d4531d2331
SHA1 9c0878dfed1eae5d270db360baaef3e9acfd7778
SHA512 e6d1bb04f4ce440e133d83326c9700e2147d54df879647fa58ee5fc5c0851b07c1f04b68043c8b11a24351b25af831fc262289354719469e8ae298e698c28617
TLSH
T1DAD097802888633C0D140F07B0E138C230984C3318B4A810F5A646789DBEFC4019191A
MD5 SHA1 SHA512 TLSH

Submit Download

839fdafd-0883-4ba2-9ca9-f75f1ca59e36

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\839fdafd-0883-4ba2-9ca9-f75f1ca59e36
Size 886B
SHA256 1de70a1e988a2fb31231ccb70fd6d3a9689158b2b26700aedb4eab8353828c85
MD5 133075527680210d9ae84907c2970e49
SHA1 0dec31403bccacddcc5e867f0a2df191fc456ed4
SHA512 58a31c5850efb0dd44ec8208f9427c6ccd9fce25b48be5d753c19d1654cae257874eefffc954d4316f2fd9d5f2028779b8503cc6d40a0386c0d851822d223320
TLSH
T1BD1100A0AA767972DC68E28BD1F577428AA47123C0C76D097E941E180CEF11E936B207
MD5 SHA1 SHA512 TLSH

Submit Download

86acbf05-b7c4-4f01-a80f-bce3f5faaaed

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\86acbf05-b7c4-4f01-a80f-bce3f5faaaed
Size 2KB
SHA256 c8c6436759b630486201e72bdb1844ce1c6a43a3d60131a9d1b587447319c2ca
MD5 069aaf8d696e50722b1265deeec57334
SHA1 9e176b9ad2835c1e0ddb1bbc30be8fb8904f4dc7
SHA512 66d2419bb6e7d71a002a1100c6579756e428724c85df9149cc305ab6337ccd7be9c7c32e203fe20794468df4518eeec39703d4c476a848d197e7049124313e9f
TLSH
T1FB41546C34B45C379CCBF28ED18123CE53748A4340C628936D92EE0C8DE669D737A12B
MD5 SHA1 SHA512 TLSH

Submit Download

e099ee22-5351-4fa8-baa7-8b0b39608341

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\datareporting\glean\pending_pings\e099ee22-5351-4fa8-baa7-8b0b39608341
Size 883B
SHA256 dd5b2c93a0264b0d5c4e927815c819822ca067e7506de623ea7ae6611892ebd9
MD5 4e21f1a0373bddf1bc4f5b9d8a7b820e
SHA1 fe03c4831a6831fa4c95f641a39c171ff46c5986
SHA512 fafbe692587e6d969da5bb46731742caceae599e7e44389d1637b97ff2706062cd1097d690c4444434ce9370d271c9174b58f9119344dfd12707473df6cbeb47
TLSH
T158110090A93678B2DC6CD14BC5E537428BF87513C0CB99083DE11E280CEE51E836B347
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 434c0632a190dda0c80a4bf7459fc776fd2a40da38ae242995466c3ebcc6b7e4
MD5 9997bd2291b277edb4f6515026e16c90
SHA1 4e2c3df8ee637ad15110bc31baa6f948f6eba460
SHA512 883adc3133de96857e19b0896713cb52e0a220d010eb3827566aaeb3e5624f2bc34a676fc3644573132fab8d353deb2079e7ad2905288d8cb958f61baf66bf3a
SSDEEP 96:xHrJUTUdGLqGq8f3fp1zSnoSSlSdv9jQnWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3fpWoSS0bQuBw88jUo
TLSH
T19BE13F789448CB6F74B6776C6C6888719AB2013BB7BF68C750BA54C4011CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js
Size 6KB
SHA256 1db351667351fc5c305528e4f33f22e6cef2fc9ea8d13ff49497bf7f7913800f
MD5 835627cd7117c9b6851f79b580caa7a1
SHA1 5fbc9669765789dd178cff87b146909a7e31fca2
SHA512 20a7eceb856162a46004c991174a0ba3d0d17536b1e2f6c36be69038c4da9dc03bdd2e3089b71e9240caa7c23d9db4a5b5a907b8f196ea4611f3e2b2b5396fe9
SSDEEP 96:xHrJUTUdGLqGq8f3pf1zSGSSlSdv9jQnWHbQW/Bw88n8L4cnuVCLM:RJNGGR8f3pfjSScbQuBw88jUo
TLSH
T12AE13F7895088F6FB4B6776CAC6888715AB2013B77BF68C750BA54C4015CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2400-2566-0x0000000000D20000-0x0000000000D23000-memory.dmp

Download

memory/2400-2584-0x0000000002FB0000-0x0000000003582000-memory.dmp

Download

memory/2400-2593-0x0000000002FB0000-0x0000000003582000-memory.dmp

Download

memory/2400-2594-0x0000000002FB0000-0x0000000003582000-memory.dmp

Download

memory/2400-2592-0x0000000002FB0000-0x0000000003582000-memory.dmp

Download

memory/3324-1368-0x0000013E5A820000-0x0000013E5A84A000-memory.dmp

Download

memory/3324-1359-0x0000013E58F50000-0x0000013E58F60000-memory.dmp

Download

memory/3324-1369-0x0000013E5A820000-0x0000013E5A844000-memory.dmp

Download

memory/3324-1365-0x0000013E58EE0000-0x0000013E58F02000-memory.dmp

Download

memory/5096-889-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-936-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-435-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-410-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-408-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-404-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-397-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-396-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-395-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-878-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-879-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-882-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-883-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-885-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-245-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-0-0x0000000002100000-0x0000000002103000-memory.dmp

Download

memory/5096-893-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-891-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-239-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-896-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-898-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-904-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-910-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-916-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-922-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-926-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-928-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-934-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-933-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-516-0x0000000074DC0000-0x0000000075144000-memory.dmp

Download

memory/5096-938-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-935-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-932-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-942-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-940-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-200-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-944-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-948-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-950-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-951-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-957-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-999-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-1357-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-1358-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-183-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-146-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-105-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-88-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-46-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-2565-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-2567-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-47-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-41-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-9-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-5-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-1-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-2600-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-2601-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download

memory/5096-2605-0x00000000022F0000-0x00000000023AC000-memory.dmp

Download